Malicious PDF — malware analysis report

Static analysis result for SHA-256 35d8cd11724a7d22…

MALICIOUS

PDF

74.0 KB Created: 2021-03-21 03:17:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 492808c5592bb91d8cc7a597fae2702e SHA-1: d80c7da05575338f610cbbb1125a64b80debad65 SHA-256: 35d8cd11724a7d22d6003a7899af9e84702132701276ccb93ed69b60f067a481
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, with a high risk score. It contains an embedded URI pointing to a suspicious domain, and numerous other URLs were extracted, many of which are associated with potentially malicious content. The document body, though heavily obfuscated, suggests a lure related to 'mathworksheets4kids'. The presence of PDF_URI and EMBEDDED_URL heuristics indicates the file's intent to redirect users to external, potentially harmful, resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/wix?keyword=mathworksheets4kids+identifying+triangles+answers
    • http://bupetud.xyz/65526596087k976.pdf
    • http://idealica-italy.site/39967780347h5yiy.pdf
    • https://cdn.sqhk.co/bafujifi/gjgeicI/65447160738.pdf
    • http://zuxekagapefe.mygamesonline.org/capacitores_en_paralelo_ejercicios_resueltos.pdf
    • http://idealica-official-it.website/breaking_rules_examples0mkma.pdf
    • http://kadanijojabuf.mywebcommunity.org/28104779338.pdf
    • http://okrasote.info/the_martian_full_movie_download_in_hindi_hdadpqv.pdf
    • http://all-casino.xyz/chocolate_2005_full_movie_480pzdrje.pdf
    • https://cdn.sqhk.co/perokokamosa/jhhfpii/icd_10_gunshot_wound_right_foot.pdf
    • http://xujaxul.mywebcommunity.org/96402371984.pdf
    • https://cdn.sqhk.co/dagosasojo/pjagcNN/36902039438.pdf
    • http://rukozhop-guide.com/96472534314w9vbc.pdf
    • http://ig-soft-team.com/wurigetiwibesema5q0gr.pdf
    • http://roman-holidays.shop/aprilaire_800_electricity_costp6w0a.pdf
    • http://help-bluebadgecustomer.com/what_is_ariel_from_the_little_mermaid_last_nameq6ilb.pdf
    • http://wabiferofuvud.mygamesonline.org/adulteration_of_food_chemistry_project.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/e5a96d1b-e2cf-4d7d-99f1-504102d1b476/united_colors_of_benetton_hot_perfume_price_philippines.pdf
    • https://uploads.strikinglycdn.com/files/c3501223-9523-4ee2-8680-1663dc4fe4dc/do_they_still_make_kerosene_heaters.pdf
    • https://uploads.strikinglycdn.com/files/b4eab7c8-75d7-4d98-b37c-31b0bac50765/baxubeladovi.pdf
    • http://petojijoxura.onlinewebshop.net/zeginasubomozuv.pdf
    • http://madigekole.onlinewebshop.net/catcher_in_the_rye_chapter_summary_13.pdf
    • https://uploads.strikinglycdn.com/files/05e74675-1772-4cb3-9525-ccbc17f35a47/nuraxurosojofil.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e620.bin
6e1456c973e3b22a704eb12007603b0e25dd40a05cf2f120b80bb0513973246b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE620 5520 bytes
font_01_sfnt_off0000f90f.bin
2f908acbe20680efa50efa0190c049a72a6c3be269b012c900fb11fb12c91dd2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF90F 9796 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.